Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
The Canadian Centre for Cyber Security says CVE-2026-48842, a pre-authenticated SQL injection in Roundcube Webmail's virtuser_query plugin, is being exploited four months after its May patch. Unauthenticated attackers can bypass login, run database commands, and steal data from the Roundcube database. Fixes are in versions 1.6.16 and 1.7.1, while Shadowserver tracks more than 523,000 exposed instances. Earlier Roundcube bugs were used by Winter Vivern and APT28, and CISA has previously listed other Roundcube flaws as exploited.
- CVE-2026-48842 is a pre-auth SQL injection in virtuser_query.
- Fixed in Roundcube 1.6.16 and 1.7.1, released in May.
- Canadian Cyber Centre says in-the-wild exploitation is now reported.
- Shadowserver tracks more than 523,000 internet-exposed Roundcube instances.
- Removing the virtuser_query plugin closes the vector if patching is delayed.
- CVEs
- CVE-2026-48842CVE-2023-5631CVE-2020-35730CVE-2020-12641CVE-2021-44026CVE-2025-49113CVE-2025-68461
- Vendors
- Roundcube
- Products
- Roundcube WebmailcPanel
- Threat actors
- Winter VivernAPT28
- Organizations
- Canadian Centre for Cyber SecurityShadowserverCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-12641 | Command Injection RCE in Roundcube Webmail (CVE-2020-12641) | 9.8 | 84% | KEVPoC | KEV |
| CVE-2020-35730 | Cross-Site Scripting in Roundcube Webmail Plain-Text Email Link Handling | 6.1 | 33% | KEV | KEV |
| CVE-2021-44026 | SQL Injection in Roundcube Webmail via Search Parameters | 9.8 | 70% | KEV | KEV |
| CVE-2023-5631 | Stored XSS in Roundcube Webmail exploited in the wild (CVE-2023-5631) | 5.4 | 76% | KEVPoC | KEV |
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2025-68461 | Cross-Site Scripting via SVG animate Tag in Roundcube Webmail | 6.1 | 27% | KEV | KEV |
| CVE-2026-48842 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash… | 8.1 | 2% | PoC ×3 |
From the original article
2 min read at bleepingcomputer.com
A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.